Magic state cultivation cut errors about 40-fold on Google's Willow processor, the first hardware run of a step that existing qubit counts for breaking Bitcoin's cryptography had taken on trust. The same paper puts an RSA-2048 break a million times beyond the quality achieved.
Google Quantum AI has demonstrated on hardware the state-preparation step that recent estimates of a quantum attack on Bitcoin had assumed would work. In a paper published in Science and announced on October 15, its researchers reported that a technique called magic state cultivation cut errors in preparing a particular quantum state about 40-fold on the company's Willow processor, reaching a logical fidelity of 99.99% that Google describes as a record. The paper sits behind a subscription, and the account that follows comes from Decrypt and The Quantum Insider, which read it alongside Google's accompanying post and agree on every figure cited here.
Quantum error correction on its own protects only a restricted set of operations. Running an arbitrary algorithm also needs magic states, and the T-states used in this work are consumed as they are used, so a long computation requires a steady supply of fresh ones. Making clean ones is the expensive part. Resource estimates Google cites put their manufacture at as much as 95% of a machine's capacity, though The Quantum Insider notes that is a modeling figure rather than a measured allocation on Willow.
Cultivation injects a rough magic state into a small patch of the chip, checks it with repeated measurements, discards the attempts that fail and grows the survivor into a larger code. Craig Gidney, Noah Shutty and Cody Jones proposed the approach in 2024, and until this experiment it existed only in theory and simulation. Willow holds 105 superconducting qubits, and the state transfer used 54 of them, moving a state from a distance-3 color code into a distance-5 surface code. Roughly 8% of attempts survived every check, so most of the work is thrown away.
The qubit counts attached to a quantum attack on cryptography already assume cultivation works. A March 2026 whitepaper from Google Quantum AI, written with Ethereum Foundation researcher Justin Drake and Stanford cryptographer Dan Boneh, put fewer than 500,000 physical qubits on breaking the elliptic curve cryptography that authorizes Bitcoin transactions. Gidney's 2025 estimate for factoring an RSA-2048 key came down to under a million noisy qubits from the 20 million he had calculated in 2019. Cultivation is one of the techniques behind that reduction.
Alex Pruden, chief executive of Project Eleven, told The Block the demonstration does not by itself move the date of a quantum break, because earlier resource estimates had already taken the technique for granted. What it does, in his account, is validate that assumption, which makes those estimates more credible and the timeline they describe more certain. Nic Carter of Castle Island Ventures told the same outlet that quantum timelines are compressing, with AI-assisted work contributing to the pace, while adding that there is no imminent threat.
The distance still to cover is large, and the paper puts a number on it. A logical fidelity of 99.99% is one error in every 10,000 states. Decrypt reports that the paper sets the requirement for factoring an RSA-2048 key near one error in 10 billion, which is a factor of a million between those two figures. Google's own projection is that halving Willow's underlying hardware noise would bring magic state errors to about two in 100,000, because the error rate falls with the cube of the noise level.
The experiment's caveats run in the same direction. The Quantum Insider reports that in a storage test the logical error rate after additional error-correction cycles came out about seven times worse than simulations predicted, and that the researchers identified leakage, qubits drifting out of the two states the computation uses, as the likely main cause. Their simulations did not model leakage and their circuits carried no operation to remove it. Reinforcement learning was used as a final calibration step, and the team built a measurement method that reports a lower bound on fidelity rather than an exact figure, after finding that combining inconsistent measurements had overstated it. Google says larger demonstrations are needed before the approach can support practical fault-tolerant computing.
Preparation on the other side continues on its own schedule. Coinbase published its technical priorities for a Bitcoin post-quantum transition earlier this week, according to The Block, describing the work as complex and running over several years, and Google has set itself an internal target of moving to post-quantum cryptography by 2029. Ethereum has a December 2029 deadline of its own, which implies a hard fork roughly every seven months. Drake, a co-author of the Google whitepaper, has argued separately that ECDSA could break before a quantum computer arrives, through machine-generated mathematics rather than hardware.
Nothing in this week's result changes what a wallet can do today, and the estimates at issue concern the elliptic curve cryptography that authorizes transactions rather than any other part of the system. What changed is the confidence around the numbers. A figure that rested on a technique nobody had run now rests on one that has been run once, on 54 qubits, with roughly 92% of the attempts discarded.
